Use Case Builder Implementation Guide

The Use Case builder contains tools to help you measure and track use cases through your automation journey, quickly autogenerate OOTB playbooks and custom workflows and more.

Setup And Configuration

To run this content you will need to setup the Cortex REST API integration. To do this, simply download and install the content from the marketplace, generate a api key, then add your api key to the instance (Choosing the standard authentication method.) Once that is complete, you can start using the Use Case Builder!

Default Incident Type

This Pack includes an Incident Type of 'Use Case Builder', which is the starting point for creating new Use Cases. To use this, navigate to the +New Incidents -> Select Type -> Use Case Builder+ and fill out the form to begin.

Layouts

The Use Case type has an optimized layout for both the summary pages, and the new/edit screen. This layout includes some useful information and dropdowns to kickstart your automation journey

Playbook

The default playbook is Use Case Builder, this playbook is performs alot of complex task and time consuming actions for you. At it's core the playbook simply does the following:

Provide important information to get you started.
Clones and Autogenerates playbooks based off your selections
Set SLAs and Timers for the development stages
Renders Markdown and HTML
Generates the Use Case Defintion Document
Evaluates XSOAR Usage and sets Adoption Metrics

Timers

Optionally this playbook has built in Timers for adding metrics for time spent In Development, Testing, Backlog, Production,etc.

Dashboards

This pack includes 1 dashboards:

Use Case Development Dashboard: High level summary of all Use Cases in Development and their associated metric data.

Dynamic Sections

There are Several Dynamic sections in this pack such as the Getting Started, Common Use Cases and Incident Flow section which are your guide to following XSOAR Best Practices and creating great use cases

Name	Description
UseCasePlaybookAutoGenerator
CreateUseCaseStepsList
PlaybookAutoGeneratorDynamicSectionMessage
UseCaseDevelopmentTimers
CreateUseCaseTemplateList
GettingStartedWithXSOAR
UseCaseAdoptionMetrics
DeleteAndExcludeIndicators
StopUseCaseDevelopmentTimer
UseCaseBuilderMarkdownToHTML	Converts Markdown to HTML.
CreateXSOARIncidentFlowList

Name	Description
Use Case Automation
Use Case Development Dashboard

Name	Description
XSOAR Incident Flow
CVE Score
Network Security IDS
Use Case Builder Development Deadline
CVE Description
Use Case Builder Email Gateway
Affected Host
Use Case Builder Playbook Generator Key
Customer Name
Use Case Production Timer
Trigger
Third Party Integrations
Use Case Category	Select Use Case Category
Use Case Builder Use Case Containment Steps
Use Case Builder Endpoint
Manual Steps
Use Case Testing Timer
Use Case Enrichment Steps
Use Case Purpose
Use Case Priority
Use Case Builder Auto Generator Key
Use Case Name
Use Case Builder Vulnerability Management
Deduplication Logic
Incident Structure and Mapping
Time to Investigate
Use Case Builder Data Enrichment and Threat Intelligence
Use Case Pre-Production Timer
Use Case Design Best Practice
Incident Response Process
Use Case Ingestion Best Practice
CVE Reference Links
Use Case Builder Forensics and Malware Analysis
Use Case Builder Authentication
Use Case Builder IAM
Enrichment
UseCaseAdoptionMetrics
Use Case Enrichment Actions
Use Case Required Metrics and Notifications
Use Case Builder SEIM
Use Case Initiator	How is the incident created in XSOAR?
End-User Interactiveness
Time to Triage
Use Case Development Stage
Use Case TIM Best Practice
subclassification	For CMNG
Use Case Builder Getting Started
Use Case Builder Network Security NGFW
Use Case Type	Select from pre-built templates or Out-of-the-Box Use Cases
Use Case Development Timer
Use Case Builder Case Management
Use Case SLAs
Custom Incident Data Structure
Time to Remediate
Use Case Backlog Timer

Name	Description
XSOAR Training
Quick Start Use Case
Use Case Builder

Name	Description
Generate Use Case Builder Lists	This playbook generates and saves the list types
Use Case Builder Playbook Reset	This playbook resets the incident when the user chooses to start over.
Quick Start Investigation	This playbook contains the investigation steps in the Quick Start Playbook
Use Case Builder	The main playbook for the Use Case Builder
Create XSOAR Incident Flow List	This playbooks creates the html process flow list
Quick Start Main Playbook	The main playbook for the quick start incident
Create Use Case Steps List	This Playbook Creates the lists used in the Use Case Builder
Create Use Case Template List	This Playbook creates the HTML Use Case Builder document list
Entity Enrichment - Generic v4	Enrich entities using one or more integrations.
Quick Start Remediation	This contains the remediation and triage steps for the Quick Start Investigation
Generate Playbooks Based On Category	Takes the use case selected category and auto creates an example playbook
Setting up the Use Case Builder Content	This playbook generates the flow, markdown, and layout information

Name	Description
Use Cases in Development
Use Cases in Backlog
Use Cases On Track
Use Cases in Testing
Use Case Development
Total Use Cases
Use Case time in Production
Use Case Backlog Time
Use Case Time Spent in Testing
Use Cases In Pre-Production
Use Cases
Use Cases in Production
Time Spent in Pre-Production

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
Base	By: Cortex XSOAR
CaseManagement-Generic	By: Cortex XSOAR Customer Success
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Atlassian Jira	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Supported By	Community
Created	June 29, 2023
Last Release	December 20, 2023

Use Case Builder

Use Case Builder Implementation Guide

Setup And Configuration

Default Incident Type

Layouts

Playbook

Timers

Dashboards

Dynamic Sections

Playbooks

Use Case Builder

Scripts

UseCasePlaybookAutoGenerator

Incident Fields

Scripts

CreateUseCaseTemplateList

Incident Fields

Incident Types

Layouts

Playbooks

New: Entity Enrichment - Generic v4

Setting up the Use Case Builder Content

Use Case Builder

Quick Start Investigation

Use Case Builder Playbook Reset

Generate Use Case Builder Lists

Quick Start Remediation

Create XSOAR Incident Flow List

Create Use Case Template List

Quick Start Main Playbook

Generate Playbooks Based On Category

Create Use Case Steps List

Scripts

UseCaseAdoptionMetrics

CreateUseCaseTemplateList

Incident Fields

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER